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MEMORANDUM TO THE DEPUTY MINISTER 
IRCC 2022-2024 RISK-BASED AUDIT PLAN 


FOR APPROVAL 


SUMMARY 


e The purpose of this memorandum is to seek your approval for the Immigration, Refugees 
and Citizenship Canada (IRCC) 2022-2024 Risk-Based Audit Plan (RBAP). 


The draft 2022-2024 RBAP was presented to the Departmental Audit Committee (DAC) on 
March 22, 2022. Comments received from the Committee were incorporated into the final 


version of the Plan (see Annex A). The final revised version was then provided to the 
external members of the Committee. No further changes were suggested. The Chair of the 
Committee recommended the Plan for the Deputy Minister’s approval. 


It is recommended that you approve the attached IRCC 2022-2024 RBAP on or before 
June 30, 2022, so that our planned audit engagements will be officially authorized. 


BACKGROUND: 


e The Treasury Board Policy on Internal Audit and supporting Directive on Internal Audit stipulate 
that the Deputy Head is responsible for approving the departmental RBAP based on their DAC 
recommendation and submitting it to the Office of the Comptroller General (OCG) annually. 


CURRENT STATUS: 


e The Internal Audit and Accountability Branch (IAAB) has prepared this RBAP to outline the 
planned audit engagements (including assurance and advisory engagements) from 2022-23 
through 2023-24. The Plan sets out the priorities of the internal audit function which are aligned 
with the department’s strategic goals and priorities, while addressing the areas of highest risk and 
significance. 


e A presentation of the draft 2022-2024 RBAP was delivered to the DAC on March 22, 2022. The 
consultation process and risk assessment methodology were presented and the proposed audit 
engagements for the next two fiscal years were discussed. The Committee reviewed the proposed 
plans and provided comments and suggestions. 
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e The 2022-2024 RBAP (see Annex A) was finalized by incorporating comments received from 
the Committee members at the March meeting (see Annex B). The final Plan was subsequently 
provided to the external Committee members for review and no further changes were suggested. 
The Chair of the Committee recommended the final Plan for the Deputy Minster’s approval. 


e Upon receipt of your approval, LAAB will begin the planned audit engagements for Year 1, fiscal 
year 2022-2023. 


RESOURCE IMPLICATION: 


e [AAB is expected to be able to complete the audit and consultation engagements in the Plan 
within their existing budget allocation. 


COMMUNICATION IMPLICATION: 


e As the plan itself is internal to government, media attention 1s not anticipated. A communications 
assessment will be done for each internal audit once it is ready for review. 


RECOMMENDATION: 


e We recommend that you approve the IRCC 2022-2024 RBAP (see Annex A) by checking the ‘I 
concur’ box and signing this memorandum on or before June 30, 2022, so that our planned audit 
engagements will be officially authorized. 


NEXT STEPS: 
e JAAB will forward the approved 2022-2024 RBAP to the OCG before June 30, 2022. 


e Throughout the year, IAAB will monitor and review emerging risk areas that could impact 
departmental objectives. As such, the RBAP will be reviewed for possible changes to the planned 
engagements at the October 2022 DAC meeting. 


Nicole Primeau 


E I concur 


And want to encourage the ongoing review of how we are doing against our action plans of already completed audits. 


m I do not concur 


a/DM Caroline Xavier e-approved June 29, 2022 
Caroline Xavier 
Acting Deputy Minister 


Annexes (2) 

A: IRCC 2022-2024 Risk Based Audit Plan 

B: IRCC Departmental Audit Committee Meeting Record of Decisions (March 22, 2022 Pre-DAC 
Meeting, item #3) 
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IRCC Risk-Based Audit Plan 
2022 to 2024 


Approved by the Acting Deputy Minister on xxxx, 2022 
Recommended for Approval by the Departmental Audit Committee on xxxx, 2022 
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1. IRCC’s Risk-Based Audit Plan Process 


e The Internal Audit and Accountability Branch's (IAAB) Risk-Based Audit Plan (RBAP) outlines the planned audit engagements 
to be undertaken over the next two fiscal years, 2022-2023 and 2023-2024. 


e The RBAP is updated at least annually as emerging risks and priorities are identified and is therefore an evergreen plan to 
ensure that the Internal Audit function is focused on the areas of highest risk and highest departmental priorities. This 
also ensures that the plan is adding value to the department and providing senior management with timely advice and 
recommendations to make informed decisions. 


e The RBAP complies with the TB Policy on Internal Audit and conforms with the International Professional Practices Framework 
(IPPF) which requires that engagements are focused on assessing the adequacy and effectiveness of risk management, 
governance and internal control mechanisms. 


Proposed RBAP Process Timelines 


Ongoing March 2022 June 2022 June 2022 
Conduct risk assessment Present proposed RBAP Present final 2022-2024 Obtain DM approval 
analysis through engagements to the RBAP to the DAC for and submit RBAP to 
document review and Departmental Audit recommendation to DM the Office of the 
consultations with Committee (DAC). Update for approval Comptroller General 
stakeholder groups and the proposed plan 
Senior Management following DAC discussion 
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1. IRCC’s Risk-Based Audit Plan Process (Con't) 


Review IRCC priorities 
and commitments, 
mandate, and policies, 
directives, and 
standards. 


e Update and realign Audit 
Universe, based on IRCC 
priorities, as needed. 

e Validate the audit 
universe with key 
stakeholders. 

e Continuous monitoring 
of timely and relevant 
information serves to 
update the audit 
universe. 


IAAB Management Team and staff 

Senior Executive-level Committees (ExCom, CFC, 
TransCom, DTPB, etc.) 
Ministerial/Departmental priorities 

DG and ADM-level stakeholders 

Anti-Racism Advisory Board 

External Audit Agencies (OAG & OCG) 


Risks associated with each 
audit entity are assessed 
using a risk taxonomy and 
documented in respective 
entity profiles. 
Information is gathered on 
an ongoing basis and 
entity risk profiles and 
assessments are 
evergreen. 


Based on resource and 
timing considerations, a 
schedule for audit 
engagements is 
developed and included 
in the IRCC RBAP. 

The IRCC RBAP is 
presented to the DAC for 
recommendation and 
approval. 


Program Management Tables, Program Stock Takes 


Performance Information Profiles 
IRMB & SPPB Risk Discussions and reporting 


Research and Evaluation Branch & Corporate Risk Management (e.g., 


Departmental Evaluation Plan, Corporate Risk Profile) 
Working-level committees (e.g. TB-Sub WGs) 
Like-minded OGDs (e.g. CBSA and Intradepartmental WGs) 
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2. Projects in Progress 


Digital Platform Modernization (DPM) — Phase 1 

e MAP Validation for Health Check #1 and Independent Third Party Review 
Digital Platform Modernization (DPM) — Phase 2 

e Health Check #1 — Completed 
Digital Platform Modernization (DPM) — Phase 3 

e Health Check #1 — Completed 
Anti-Racism, Equity, Diversity and Inclusion (AREDI) — OPPB Pilot (DAC: October 2022) 
Settlement Provider Organizations (SPO) Administrative Rate (DAC: October 2022) 
Biometrics (DAC: October 2022) 
Employment Systems Review (DAC: June 2023) 
Afghanistan Lessons Learned (DAC: October 2022) 


Digital Platform Modernization (DPM) — Phase 2 
e Health Check #2 
e Deep Dive - Governance 

Digital Platform Modernization (DPM) — Phase 3 
e Health Check #2 


CHRC — Horizontal Audit of the Employment of Racialized People in Executive and Management Positions in the Public Sector 
OAG — Update on Past Audits Phase 2 

TBS — Passport Modernization Initiative Governance Case Study 

OAG — Audit of Greening Government Strategy 


Parks Canada — Benchmark Study KPMG Resourcing Review 

PSC — Audit of Employment Equity Representation in Acting Appointments 

OAG — Audit of the 2021-22 Consolidated Financial Statements of the Government of Canada 
CNSC — Change Management Benchmarking Exercise 


oe LUE dE EE ru 
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3. New Projects — 2022-2023 


Corporate Services 
1. Advisory — Anti-Racism, Equity, Diversity and Inclusion (AREDI) — Phase II (Maturity Model Pilot) 


e Preliminary Objective: To conduct a maturity assessment of the department in areas of anti-racism, diversity, equity and inclusion and to 
determine potential measures enabling the advancement of measurable change along the maturity continuum. 


e Alignment with IRCC Priorities: Mandate Commitment — SFT Pillar — Systemic Racism and Diversity // IRCC Priorities — Organizational Resilience. 


2. Audit — Audit of Enterprise Project Management 
e Preliminary Objective: To assess the maturity of the Department’s project management capability. 


e Alignment with IRCC Priorities: Mandate Commitment — Supports Ministerial Mandate Letter to adapt and develop more agile and effective ways 
to serve Canadians. // IRCC Priorities — Transformation. 


Operations and Strategic Program Policy 
3. Audit — International Student Program (ISP) — Phase II 


e Preliminary Objective: To assess the effectiveness of controls in place to ensure program compliance, integrity and prevention of fraud. 


e Alignment with IRCC Priorities: Mandate Commitment - Reducing application processing times, improving client services and service delivery. 


4. Audit — Immigration & Citizenship Consultants 
e Preliminary Objective: To assess the adequacy and effectiveness of the framework governing immigration and citizenship consultants. 


Alignment with IRCC Priorities: Mandate Commitment - Supports Ministerial Mandate Letter commitments, funded through Budget 2022-23. 
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3. New Projects — 2022-2023 continued 


Preliminary Objective: To-assess whether the Department has identified, assessed, and addressed the information security risks posed by the 
information management changes implemented due to the impacts of the pandemic. 


e Alignment with IRCC Priorities: Mandate Commitment — Supports Ministerial Mandate Letter to adapt and develop more agile and effective ways to 
serve Canadians// IRCC Priorities — 
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4. Future Projects — 2023-2024 


Operations and Strategic Program Policy 
1. Audit — Migration Program - Undocumented Migrants 


¢ Preliminary Objective: To assess the effectiveness of both the Internal Control and Integrity Frameworks for the program. 


¢ Alignment with IRCC Priorities: Mandate Commitment — Leading the Government’s work on irregular migration and modernizing the Safe Third Country 
Agreement 


2. Advisory — Vaccine Strategy for Clients — Migration Health Branch (MHB) 
e Preliminary Objective: To assess the effectiveness of MHB’s phased approach to the vaccination strategy for clients coming to Canada. 


¢ Alignment with IRCC Priorities: Reform Objectives — Settlement and Resettlement 


3. Audit - Management Control Framework for Advanced Analytics (AA) (Data Governance) 
e Preliminary Objective: To assess the adequacy and effectiveness of the Management Control Framework for Advanced Analytics. 


¢ Alignment with IRCC Priorities: Transformation 


Settlement and Integration 
4. Audit — Settlement Program (Gs&Cs) 


e Preliminary Objective: To assess whether the governance structure, risk management practices and controls in place are adequate and effective to manage the 
funding instruments, as well as program integrity in terms of recipient compliance. 


e Alignment with IRCC Priorities: Mandate Commitment - High quality settlement services and rigorous approach to measure outcomes // 
IRCC Priorities - Reform Objectives — Settlement and Resettlement. 


5. Audit —IT Security 
e Preliminary Objective: To determine the effectiveness of Information Systems Management controls in place. 


¢ Alignment with IRCC Priorities: 
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5. Areas to Watch (Year 2 and Beyond) 


1. Asylum Program 


2. Business Continuity Planning 


3. Sub-components of the Passport Program Modernization Initiative (PPMI) (i.e., PDS, ePassport, PPMI Abroad) 


4. Immigration Approval Process 


5. Crisis Management 


6. Integrated Planning 


7. Change Management 
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6. Resourcing Considerations 


e The Audit Operations Directorate is building capacity within the Branch to deliver the Year 1 projects of the RBAP. A 
dedicated audit team has been established to effectively support DPM assurance activities. 


e Given the high volume of proposed projects, IAAB will supplement the internal resources with external consultants, as 
required, to deliver some engagements. Since 2018, the Branch has put multi-year contracts in place to provide access 
to professional services for specific skills and competency requirements (i.e. IT, forensic, project management). 


e An increase in workload beyond the proposed projects during Year 1 (such as ad-hoc reviews) will impact the Branch’s 
ability to carry out planned projects on time and may impact employee wellness. 


Audit Principal 


Audit Team Leader* 


Senior Auditor 


Auditor 


Total 


* Includes two acting team leaders 
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PRE-DEPARTMENTAL AUDIT COMMITTEE (DAC) 
Meeting Record of Decisions 


March 22, 2022 (1:00 p.m. to 3:05 p.m. EST) 


sment Results 


Purpose: Update 
Presenter: Hughes St-Pierre, CFO/Comptroller 


Decision/Roundtable: 


The CFO presented the annual update on the internal control monitoring program to the Committee. The overall 
risk level has not changed from previous years. 


The Committee also asked the CFO what items “keep him up at night”. The CFO noted the amount of pressure 
that the Department is under to deliver the highest levels plan in history. The Department has many major 
commitments (1.e. Afghanistan, Ukraine, etc.) but not enough funding to support all activities. For example, 
IRCC recruited 11K new staff last fiscal year and this level is expected to double in the upcoming fiscal year; the 
Department may not have the necessary knowledge, experience and capacity to handle both onboarding and 
operational processing in parallel. The Committee questioned how well the Department on-boarded the 11K staff 
this year, and the CFO noted that the achievement of the levels plan target is a good indication. The Department 
also still needs to crystalize the workplace that IRCC wants to be in the future; the definition of a “hybrid 
workplace” for the Government of Canada is still unclear in terms of central agency direction to date. 


the Department has completed a significant amount of work and achieved considerable 
success, yet these accomplishments aren’t truly reflected in the media. The CFO agreed that the Department 
should explore opportunities to highlight its achievements and enhance the public narrative. 


Action N/A Deadline N/A 
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Purpose: Discussion 


Presenter: Rina Lorello, A/ADM Transformation 


Liz McKeown, DG Digital Strategy Branch 
Holly Flowers-Code, ADM Corporate Services 
Marie-Flore Baptiste, DG Projects Branch 


Decision/Roundtable: 


The IRCC IT investment plan was presented jointly to the Committee. ADM Holly Flowers-Code stated that 
there has been a significant shift in comparison to previous investment plans because the Department is growing 
significantly. It was noted that the Department has maintained a Class 2 Tactical OPMCA rating and all 
investments are subject to the gating process. Corporate Services is working closely with ADM Jason Choueiri’s 
group (Modernization) to support the program management framework. 


It was noted that the Deputy Minister Committee on Enterprise Priorities and Planning (DM CEPP) expressed an 
interest to Shared Services Canada to be engaged at the earliest project gating (1.e. gate 0 to 2) instead of gate 4 in 
order to better support the project. It was also noted that vendor capacity to support IT projects 1s one of the 
greatest challenges; ensuring the right resources are in place is critical for success, but the federal procurement 
process is complex and lengthy, and many departments are competing for the same resources. 


The Committee asked what the Department is doing to address the most significant risks in terms of the current 
project environment and internal resources. 


Also, through the PCRA assessment, areas in which the Department has weaknesses are highlighted 
and targeted for improvement. 


The Committee expressed concern that the Department has too many initiatives and 1s recruiting continuously to 
acquire the capacity needed to address expanding priorities. The presenters confirmed that it 1s very difficult for 
the Department to prioritize due to global changes that also have impacts on the Department. It was also noted 
that the Department has lost talent to the private sector while dealing with administrative burden and central 
agency requirements. 


The Committee also commented that the Department must focus on strategies, prioritization, and risks because 
the reputation of the Government of Canada is on the line. The Department has had good fortune in managing its 
erowth to date, but needs to identify areas for consolidation. The Committee also commented that there is a lack 
of flow between all 3 phases of the Digital Platform Modernization (DPM) and there is a need to more clearly 
demonstrate the connections between them. 


Action N/A Deadline N/A 
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Purpose: Update 


Presenter: Nicole Primeau, CAE, Internal Audit and Accountability Branch (IAAB) 


Decision/Roundtable: 


The CAE presented the 2-year RBAP to the Committee and noted that the OCG will be changing the RBAP 
process and timelines in the future, with the RBAP becoming an evergreen plan. 


The RBAP team will revisit the plan as new priorities appear throughout the year. The IAA Branch has an 
ongoing commitment to provide assurance on the largest transformation initiatives within the Department. It was 
noted that “change management” 1s a hot topic that came up multiple times during consultations and meetings. It 
is an area that the [AA Branch is considering for future audit work. 


The CAE indicated that the “PPMI” engagement might be removed from the engagement list as there are many 
projects being carried out by the TBS Internal Audit group. The final decision will be made at the next DAC 
meeting in June 2022. The CAE also explained that the DPM 1s a health check, not an audit, and that action plans 
from health checks were not shared with the Committee previously. Follow-up on health check recommendations 
should be based on the capacity of OPIs given that their current project capacity is spread very thin and they have 
an ambitious timeline (March 2023). 


The Committee suggested removing “Corporate Planning and Prioritization” from the engagement list as the DM 
and CFO are already aware of existing weaknesses, unless [AA Branch can provide new initiatives and findings 
that can add value. The Committee also commented that the IAA Branch should focus on the most critical areas 
and should be cautious of adding additional engagements to the list given its current capacity and workload. 


The Committee also suggested reserving some resources for unexpected engagement requests and would like to 
see information regarding the possibility of sharing resources between engagements, with a focus on high priority 
engagements. The IAA Branch needs to consider the number of audits and the capacity to deliver these audits. 
The CAE acknowledged that the plan is ambitious and will review it. 


The Committee indicated that there is a gap in the plan, in that there is no overarching plan to report on the 
benefits that IRCC is receiving as a result of these audits. For example, what are the real benefits that an audit of 
the IT plan will achieve? What is the value of new engagements added to the plan? 


Action Deadline 


Send a revised RBAP to DAC for comments and approval April 2022 
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s.16(1)(c) 


Presenter: Nicole Primeau, CAE, Internal Audit and Accountability Branch (IAAB) 


Decision/Roundtable: 


The Information Items were reviewed prior to the health break. 


The Committee asked if any items on the DAC agenda for March 29 required additional attention. The CAE 
identified some items and explained IAA priorities and capacity. The Committee suggested applying a strategic, 
value-based lens in which 70% of resources would be directly tied to projects and 30% would remain adaptable 
to changes. The IAA Branch should also consider simplifying reporting documents (1.e. 2 page reports). 


The Committee indicated that they are always present to support the CAE on any types of challenges and would 
like to see how things evolve at the next Pre-DAC meeting. 


The Committee had no comments on the DAC Requested Action Items. 


Purpose: Discussion 


Presenter: Holly Flowers-Code, ADM Corporate Service 


Josée Lapointe, DG Workforce & Workplace Management, Human Resources 


Decision/Roundtable: 


ADM Holly Flowers-Code and DG Josée Lapointe presented the workplace investigations and ethics update to 
the Committee. It was noted that the Workplace Investigations and Ethics Office has 5 investigator positions with 
one vacancy. 


DG Josee Lapointe explained the struggles that the team had experienced during the early pandemic situation. 


Action N/A Deadline N/A 


Purpose: Discussion 


Presenter: DAC Members 
Holly Flowers Code, ADM Corporate Service 


Josée Lapointe, DG Workforce & Workplace Management, Human Resources 


Decision/Roundtable: 
N/A — Discussed In-Camera 
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Regular Non-Member Presenters: 

Attendees: Hughes St-Pierre, CFO/Comptroller 
Nicole Primeau, CAE, Rina Lorello, ADM Transformation 
IAAB Liz McKeown, DG Digital Strategy Branch 


Diana Shaw-Malvern, 
Director of PPSM, IAAB seu vi Code, ADM Corporate 


Marie-Flore Baptiste, DG Enterprise Projects 
& Programme Management Branch 


Josée Lapointe, DG, Workforce & 
Workplace Management Branch 


Presentation Observers: 


Saarang1 Balasingam, Director of Audit 
Operations, IAAB 


Chantal Sabourin, Audit Principal, IAAB 


Sathy Paskaran, Internal Audit Project 
Leader, IAAB 


Paula Desousa, Audit Support, IAAB 


Mei Liu, a/Internal Audit Project Leader, IAAB 
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